### Generated pictures and scores, made natively and checked by SHA-256

- **The payload of `wai.generate.spectral`** (SPEC §5, *Payload of
  `wai.generate.spectral`*). The registration is completed (§8): the payload is an
  instruction object of form v0, one canonical JSON object naming the model by its
  SHA-256 and giving the prompt, the seed, the steps and every size a sink makes. One
  serialization per object, so an envelope's content hash names the instructions; a
  sink makes only listed sizes, with that model only, and checks each output by its
  SHA-256, never by a 64-bit FNV-1a alone. The intent of an envelope that names the
  generator is `create`, and an envelope with another intent is non-conforming. The
  model is the generator's parameter set (§3.1) and `model` its identity, so an
  envelope that names the generator carries no `prior` pin, and a sink refuses one that
  does (§3.1 says so beside the pin rules). `wai inspect` and `wai unwrap` report the
  payload, the intent and any pin of such an envelope, ✓ or ✗ with the reason. Vector:
  `wai-rs/tests/vectors/generate/instr-v0.json`, the object, the SHA-256 at each of
  its four listed sizes, twelve objects at the inclusive bounds a sink accepts (each
  with the SHA-256 of its first listed size), and 36 objects a sink refuses, each with
  the rule the reference reader finds broken first, which its tests assert.
- **`wai generate`** (feature `generate`) makes a picture with the reference generator
  at any size form v0 allows and prints its SHA-256; `--instr` makes a listed size of
  an object, read as a sink reads it, and `--write-instr` writes one. `sizes.json` pins
  the committed prompt at 256×128 and 640×320. The wasm32 workflow checks that the
  browser binding makes every pinned picture and score with the SHA-256 the native
  tool wrote (`wai-web/demo/verify_generate_wasm.mjs`), so a page can hold its own
  output to these pins. `wai wrap` refuses a `wai.generate.spectral` payload that is not a
  form-v0 object, and any intent but `create` over that generator, in every build.
- **`wai score build|render`** (feature `score`). `build` writes a `WSCR` from integer
  note fields only (score §2.3); `render` prints `samples`, `pcm_sha256`,
  `mixdown_blake3` and `score_hash`, and `--pcm` writes the samples. Every
  `score-conformance` vector now states `pcm_sha256`, and `notes/<name>.json` holds it
  in the authoring form, which `build` turns back into the committed `WSCR` byte for
  byte.
- No library source changed: the generator, the score synth, the world floor and the
  browser binding are as they were, so pins made with this tool bind the binding pages
  already load.

